Research / Agent Context Integrity
A component of agent context integrity: resolving conflicting stored facts by write-time trust
Yao Tsakpo · Independent research · July 2026
System studied: Inbin (reference implementation)
We use the term agent context integrity for the property that the information an autonomous agent communicates, stores, retrieves, and acts upon preserves enough provenance, attribution, verification, and conflict semantics to support reliable reasoning, and study one component of it: conflict resolution in long-lived memory. Mainstream agent-memory systems keep recency and relevance but discard the one signal that determines which conflicting fact to trust: where the fact came from. We propose attaching a discrete provenance tier to every fact at write time, human > email > agent, and resolving conflicts by tier rather than by recency. We give two closed-form accuracy models, confirm them with an exact model-free simulation, and measure the effect on five instruction-tuned models across three architectures. The contribution is not trust-based resolution, which exists; it is its move into agent memory as a discrete, write-time, unforgeable tier, where the top tier is minted only through an authenticated owner channel, so an agent cannot promote its own assertion to the tier that wins.
Whether a conflict resolves correctly is decided before the model sees the facts, by what the store chose to keep. A store that keeps only values and timestamps can offer the resolver nothing but recency; a store that also keeps each fact’s provenance can offer a principled order. Under an adversarial construction (the correct value is never the most recent), the deterministic result is exact: a recency store scores 0%, a tier store 100%. The substantive question, which no construction can settle, is whether real instruction-tuned models are pulled toward the recent wrong value when the tier is withheld. They are.
300 programmatically generated conflicts (depths 2 to 4), three prompt phrasings pooled per condition, temperature 0.4, reported as mean ± 95% CI:
| model | flat store | provenance store | gap |
|---|---|---|---|
| llama-3.3-70b | 2% ± 2 | 45% ± 10 | +43 |
| llama-3.1-8b | 3% ± 3 | 36% ± 7 | +33 |
| gpt-oss-120b | 0% ± 0 | 0% ± 0 | 0 |
| gpt-oss-20b | 0% ± 0 | 1% ± 2 | +1 |
| qwen3.6-27b* | 10% ± 19 | 10% ± 19 | 0 |
* qwen completed only a partial run (rate limiting); its wide interval reflects undersampling and we do not weight it.
The panel splits into models that engage the resolution task and models that do not. The two engaged models show a large, prompt-stable gap (+43 and +33 points) with the flat arm near zero; the rest under-engage. Across all five, the provenance condition never underperformed the flat one. The direction is a property of the data; the magnitude is a property of the model.
The tier resolver inherits the correctness of its ordering. On the 20% of conflicts where a higher tier is wrong (a stale or mistaken human decision), it is confidently wrong, dropping the overall figure to 81.7%and degrading linearly with the inversion rate. Provenance tiers convert “which fact is newest” into “which authority is highest,” an improvement only to the extent the authority ranking is sound. It is a governance mechanism, not an oracle.
This is one component of agent context integrity, read as stages an agent’s information passes through: communicate → store → resolve → act. A companion measurement studies the communicate stage; this paper studies resolve; verification and execution integrity are natural further components.